[sssd PR#187][opened] Add support to lookup for users/groups in subdomains just by the user shortname
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: opened
PR body: """ The patches are rebased on top of #154 and provide a solution for https://pagure.io/SSSD/sssd/issue/3001
There are no PAM related tests for those changes. Shall I do it using cmocka tests? Shall I rely on our downstream tests for this? """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ @sumit-bose: Sumit, I've added the lookup_order as we discussed. It's done on the same level of default_domain_suffix, as suggested by you.
Would you mind taking a look on it and giving me some feedback? I'll try to have this plus the integration with IPA* merged by the end of this week.
*:I'm starting working on the IPA's integration already ... """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-287735815
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
sumit-bose commented: """ Hi Fabiano, thank you for the patch, it looks good, I only added two minor comments. I didn't had a chance to test it yet. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-288027848
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ New patchset pushed, the fixup changes look like: ``` diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index b7e6224..bb8a942 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -550,9 +550,12 @@ representing the lookup order that will be followed. The list doesn't have to include all possible - domains as the missing domains will be looked up - based on the order they're presented in the + domains as the missing domains will be looked + up based on the order they're presented in the <quote>domains</quote> configuration option. + The subdomains which are not listed as part of + <quote>lookup_order</quote> will be looked up + in a random order for each parent domain. </para> <para> Default: Not set diff --git a/src/responder/common/responder_common.c b/src/responder/common/responder_common.c index 51f9b0f..f70fcd0 100644 --- a/src/responder/common/responder_common.c +++ b/src/responder/common/responder_common.c @@ -1198,7 +1198,7 @@ int sss_process_init(TALLOC_CTX *mem_ctx, CONFDB_MONITOR_CONF_ENTRY, CONFDB_MONITOR_LOOKUP_ORDER, &rctx->lookup_order_list); - if (ret != EOK) { + if (ret != EOK && ret != ENOENT) { DEBUG(SSSDBG_MINOR_FAILURE, "Cannot get the "lookup_order" option.\n" "The set up lookup_order won't be followed [%d]: %s.\n", ``` """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-288053292
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
pbrezina commented: """ Function `create_domains_lookup_order_list` needs to be called in `sss_dp_get_domains_process` prior calling `tevent_req_done` because subdomains may in theory change while SSSD is running. So it is not sufficient to built this list only at start up. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-288063964
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
Label: +Changes requested
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ On Tue, Mar 21, 2017 at 1:30 PM, Pavel Březina notifications@github.com wrote:
Function create_domains_lookup_order_list needs to be called in sss_dp_get_domains_process prior calling tevent_req_done because subdomains may in theory change while SSSD is running. So it is not sufficient to built this list only at start up.
Hmm. If the subdomains may change while SSSD is running, okay. Sadly it will be triggered on every cache_req call :-\
I'll do the needed changes, thanks for the review.
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/SSSD/sssd/pull/187#issuecomment-288063964, or mute the thread https://github.com/notifications/unsubscribe-auth/AAG4emBfexGziK2l6XcU3lxJD0GbhTndks5rn8LMgaJpZM4MX9_e .
"""
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-288066147
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
pbrezina commented: """ There may be someway to check if the configuration has changed. Or we can increase the default subdomain timeout from 60 seconds to some bigger value. This seems to be very short timeout given that subdomains changes are rare. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-288067788
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ @pbrezina: patchset updated.
About setting a bigger value for the default subdomain timeout, it can be discussed out of this PR scope (and I'll bring it up on our ML soon). """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-288210160
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
Label: -Changes requested
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
pbrezina commented: """ Hmm, I see more problems here. Domains can be actively enabled or disabled now from the data provider. The domains in lookup order list do not reflect this. I think the best thing to do is to create new list of domains that would contain pointer to the sss_domain_info structure. Maybe, we can move the code to cache_req since it is the only consumer.
```c struct cache_req_domain { struct sss_domain_info *domain; struct cache_req_domain *prev; struct cache_req_domain *next; } ```
This will make sure that all changes done to the domain a reflected during the search.
As I read the code, the subdomains that were removed from the trust setup are only disabled, not removed from the list. We can use this so we don't have to built the list always from scratch, i.e. only add new domains into the list (to the end of the list or after its parent domain?).
"""
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-288693368
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ As discussed with @pbrezina in a face-to-face meeting ... We're dropping the patches for the lookup order right now and those will be part of the next series (which is also taking care of the lookup order set in freeIPA).
And, of course, the comments you made will be addressed in this new PR. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-288705691
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ @pbrezina, @sumit-bose,
As this PR wasn't pushed yet I'm just updating it with the patches for domainResolutionOrder as well.
For testing it with IPA you guys will need a trust setup and from the ipa master (with latest freeipa-server installed*) you can call:
`# ipa config-mod --domain-resolution-order="a.example.com:b.example.com" ...`
For the view case: `# ipa idview-mod --domain-resolution-rder="a.example.com:d.example.c:example.com" ...`
For consistency I've kept comma as the list delimiter on sssd side (the one you can configure on sssd.conf): ``` [ssssd] ... domain_resolution_order = a,example.com, example.com, c.example.com .... ```
Hopefully we won't have that many issues ... """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289415675
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ retest please """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289415727
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ Ah! Please, set SELinux to permissive in case you're updating freeipa-server! """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289425499
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
pbrezina commented: """ Please, put the cache req domain stuff into a new cache req module instead of mixing it with responder common. Patches looks good otherwise. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289438130
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ On Mon, Mar 27, 2017 at 2:25 PM, Pavel Březina notifications@github.com wrote:
Please, put the cache req domain stuff into a new cache req module instead of mixing it with responder common. Patches looks good otherwise.
But still keeping the structure as part of the responder? I'm assuming yes, otherwise I wouldn't be able to access it from sss_dp_get_domains_send() in a straightforward way.
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/SSSD/sssd/pull/187#issuecomment-289438130, or mute the thread https://github.com/notifications/unsubscribe-auth/AAG4eqdYHVltPf3LCBiPsppbtE8pDewyks5rp6rQgaJpZM4MX9_e .
"""
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289441391
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ @pbrezina, @sumit-bose,
As this PR wasn't pushed yet I'm just updating it with the patches for domainResolutionOrder as well.
For testing it with IPA you guys will need a trust setup and from the ipa master (with latest freeipa-server installed*) you can call:
`# ipa config-mod --domain-resolution-order="a.example.com:b.example.com" ...`
For the view case: `# ipa idview-mod --domain-resolution-rder="a.example.com:d.example.c:example.com" ...`
For consistency I've kept comma as the list delimiter on sssd side (the one you can configure on sssd.conf): ``` [ssssd] ... domain_resolution_order = a,example.com, example.com, c.example.com ....
[domain/example.com] use_fully_qualified_names = False subdomain_inherit = use_fully_qualified_names ```
Hopefully we won't have that many issues ... """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289415675
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ @pbrezina, @sumit-bose,
As this PR wasn't pushed yet I'm just updating it with the patches for domainResolutionOrder as well.
For testing it with IPA you guys will need a trust setup and from the ipa master (with latest freeipa-server installed*) you can call:
`# ipa config-mod --domain-resolution-order="a.example.com:b.example.com" ...`
For the view case: `# ipa idview-mod --domain-resolution-rder="a.example.com:d.example.c:example.com" ...`
For consistency I've kept comma as the list delimiter on sssd side (the one you can configure on sssd.conf): ``` [ssssd] ... domain_resolution_order = a,example.com, example.com, c.example.com ....
[domain/example.com] use_fully_qualified_names = False subdomain_inherit = use_fully_qualified_names ```
Hopefully we won't have that many issues ... """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289415675
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ Okay, new series pushed based on @pbrezina review.
I've moved the code that made sense to me to cache_req_domain.[ch]. Not all of code was moved there as, IMHO, the part left in the responder's side looks better there.
The most part of the changes are in eafb71684c5b8 commit. This series also fixes a typo found by @sumit-bose. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289510720
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ CI: http://sssd-ci.duckdns.org/logs/job/65/88/summary.html """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289720267
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
pbrezina commented: """ LGTM """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289778242
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
sumit-bose commented: """ The patches worked well in my test. If possible please add diff --git a/src/responder/common/cache_req/cache_req_domain.c b/src/responder/common/cache_req/cache_req_domain.c index a4ccfb0..bbabd69 100644 --- a/src/responder/common/cache_req/cache_req_domain.c +++ b/src/responder/common/cache_req/cache_req_domain.c @@ -77,7 +77,7 @@ cache_req_domain_new_list_from_string_list(TALLOC_CTX *mem_ctx, for (i = 0; resolution_order[i] != NULL; i++) { name = resolution_order[i]; for (dom = domains; dom; dom = get_next_domain(dom, flag)) { - if (strcmp(name, dom->name) != 0) { + if (strcasecmp(name, dom->name) != 0) { continue; }
Otherwise ACK """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289796147
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ @sumit-bose: Squashed your patch in this latest version of the patchset.
Thanks for the review. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289811004
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ And the CI for the latest version: http://sssd-ci.duckdns.org/logs/job/66/00/summary.html """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289843893
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ So, by @lslebodn comment I've dropped the "Allow subdomains to inherit "use_fully_qualified_names" option" patch and rebased my series on top of @mzidek-rh patch for adding this option to the subdomain directly.
As I've tested @mzidek-rh patch I've already added an "Acked-by: ..." there.
That's the only change from previous series to this one. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-289998692
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ I'm removing the Accepted label till our internal CI passes """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-290004299
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
Label: -Accepted
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
lslebodn commented: """ The patch "UTIL: Simplify usage of create_subdom_conf_path " did not move function to right module. The function `create_subdom_conf_path` has nothing to do with string utils and moreover added dependency on "struct sss_domain_info". So the module `src/util/string_utils.c` could not be reused as string only module. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-290017295
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: synchronized
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ @lslebodn: your comment has been addressed in the latest patch series. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-290023234
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
fidencio commented: """ CI: http://sssd-ci.duckdns.org/logs/job/66/41/summary.html
It failed on rhel6 but the failure doesn't seem to be related to these patches. """
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-290061157
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
jhrozek commented: """ * master: 16385568547351b5d2c562f3081f35f3341f695b 1e437af958f59a0b8bf2f751d3c2ea28365ac64d 66c8e92eb5a4985bb7f64c349a53b08030a000cf 34228050af1e25706f61ec9df648852284b61c2b fb81f337b68c85471c3f5140850dccf549a2d0ac 17ab121a6c69d74acf1d40f2bbcbe90d77bb6b8a 3cbf0e7b63e8e6888917e9215bbdc5674c2fa852 723d514f641e2b5a5cbfe1c6c7bdd2a6f3c5070e 2e85b015d8dd231094a09eab69b86e8b6fcc8b2b 5856a621ac5909ca96520ac5a809eb83fd46d8bc a3442e4a268ad2172c89d58e6daa759eb4b39e7c 46c99a59c8d6501aa3ad701c567fba577924b48b dcc52d9c6411528bab815351d1e6145d211a4765 a63d74f65db2db7389cd373cb37adcdaaa2d56ea e0e038218580166648ac24f23180f0f4c2769d99
"""
See the full comment at https://github.com/SSSD/sssd/pull/187#issuecomment-290068633
URL: https://github.com/SSSD/sssd/pull/187 Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname
Label: +Pushed
URL: https://github.com/SSSD/sssd/pull/187 Author: fidencio Title: #187: Add support to lookup for users/groups in subdomains just by the user shortname Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/187/head:pr187 git checkout pr187
sssd-devel@lists.fedorahosted.org
-
fidencio -
jhrozek
-
lslebodn
-
pbrezina
-
sumit-bose